DMVPN fail over configuration for 1941 router

s.lessard · ‎03-09-2015

I have several branch offices that need a redundant path to the data center. We ordered Cisco 1941 routers and an internet circuit at each site. The primary MPLS circuit's router is managed by the service provider. I need to configure the 1941 router to use the internet circuit as a VPN backup if the primary MPLS circuit fails. How do I configure the VPN to detect the primary circuit is down and take over the route to the data center? Can this be done using IP SLA or do I need to pair with the service provider with HSRP/VRRP for the fail over to work correctly? Do I also need a keep alive on the VPN circuit so it is up and ready in the event of a failure?

On the 1941 router can the VPN be configured through the GUI or is CLI the better option?

zayalaksme · ‎03-16-2015

google for "dmvpn as a backup for MPLS".

Sorry if it is not relavent answer.

gage.fogleman · ‎03-16-2015

Not sure if you decided on something or not yet, but there are multiple things you can do. Currently we have the same setup for my companies remote sites. It depends on your routing protocol routing protocol on what exactly you will do but i would recommend to just make another DMVPN and make the metric higher for the backup route. So it will be automatic and you won't have to monitor every site all the time. Not sure if this helps or not.. But if you give more information maybe I can be a little more specific.

Thanks,

Gage

s.lessard · ‎03-20-2015

The WAN router is controlled by the service provider and is running BGP on their MPLS network. I am adding a router that I control that will be connected to an internet circuit for the DMVPN backup. I am hoping to use HSRP/VRRP but I haven't been able to get the OK from the service provider. I can then use IP SLA with tracking to detect a failover and change the priority when there is a failure. If the service provider will not do HSRP/VRRP how do I detect and change the routing to use the DMVPN circuit? The default gateway for the network is on the service provider router.

gage.fogleman · ‎03-20-2015

If the ISP has all of the gateways and won't allow you to do HSRP or VRRP the only option is to move your gateways down to a switch or router controlled by you and allow that device to make the routing decision. At that point you can just do DYNAMIC routing over BGP if they extend their BGP network to your router.